o 
o 

(N 

Ph. 
< 
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We present a fake-signal-and-cheating attack strategy for the dishonest agent in quantum secret 
sharing (QSS) to steal the information of the other agents' fully and freely. It is found that almost 
all the QSS protocols existing, such as the two famous QSS protocols, the Hillery-Buiek-Berthiaume 
[Phys. Rev. A 59, 1829 (1999)] and the Karlsson-Koashi-Imoto [Phys. Rev. A 59, 162 (1999)], 
can be eavesdropped freely if the process for the eavesdropping check is accomplished with the 
cooperation of the dishonest agent. He can sends a fake signal to the other agents after intercepting 
the original photons and storing them. His action can be hidden with entanglement swapping and 
cheating when the photons are chosen as the samples for checking eavesdropping. Finally, we present 
a possible improvement of these QSS protocols' security with decoy photons. 
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Quantum information, an ingenious application of 
quantum mechanics within the field of information has 
attracted a lot of attention 0, llj • In particular almost 
all the branches of quantum communication have been 
developed quickly since the original protocol was pro- 
posed by Bennett and Brassard (BB84)_j3i in 1984, such 
as quantum key distribution (QKD) J4,|5lp,|3, quantum 
secure direction comnuinication IMl3,El, quantum se- 

so on. QKD provides 
a secure way yj for creating a private key between two 
remote parties, say Bob and Charlie. With a private key, 
most of the goals in classical secure communication can 
be accomplished. For example, a classical secret message 
can be transmitted securely by using classical one-time 
pad crypto-system with a private key. 

In a secret sharing [sjj, a boss, say Ahce, has two 
agents, Bob and Charlie who are at remote places. Alice 
hopes that the agents can carry out her instruction (the 
message Ma), but she doubts that one of them (not more 
than one) may be dishonest and he will do harm to her 
belongings if the dishonest one can deal with it indepen- 
dently. Moreover, Alice does not know who the dishonest 
one is. For the security of the secret message Ma , Alice 
splits it into two pieces, Mb and Mc, and then she sends 
them to Bob and Charlie, respectively. The two agents 
can read out the message Ma = Mb ® Mc if and only 
if they cooperate, otherwise none of them can obtain an 
useful information. QSS is the generalization of classical 
secret sharing into quantum scenario and has progressed 
quickly in recent years HU il2. 13. 14^ 15. 16. 17. 18 . 19. 

s El m m El m m Miiiiiiig" it provides 

a secure way for sharing not only classical information 
^d2td^M. 15, 16, 17, 18, 19, 20, 21, 22, 23, 24], but 
also quantum information |25!, 26, 27, 28|. In the latter, 
the sender, Alice will send an unknown quantum state 



to her m agents and one of them can recover it with the 
help of the others |23- Now, QSS has also been studied 
in experiment |29l |30j. In general, QSS is by far more 
complex than QKD as the dishonest agent, a powerful 
eavesdropper, has the chance to hide his eavesdropping 
with cheating. 

Almost all the QSS protocols existing can be attributed 
to one of the two types, the collective eavesdropping- 
check one and the individual eavesdropping-check one. 
The feature of the QSS protocols based on a collective 
eavesdropping check is that the process of the eavesdrop- 
ping check can be completed only with the cooperation 
of the dishonest agent. That is, the boss Alice should 
require the dishonest agent to publish his outcomes of 
the samples for checking eavesdropping or his operations 
on them. Otherwise, she and the honest one cannot ac- 
complish the process. The typical models are the two 
famous QSS protocols, the two pioneers, the Hillery- 
Buzek-Berthiaume 1999 (HBB99) ]Tl| and the Karlsson- 
Koashi-Imoto (KKI) _12]. In contrast, in the individ- 
ual eavesdropping-check QSS protocols, the eavesdrop- 
ping check between the boss Alice and the honest agent 
need not resort to the information published by the dis- 
honest one. In other words, Alice and the honest agent 
can analyze the error rate of their samples independent 
on the dishonest one. Typical such QSS protocols are 
the ones presented in Refs. [23, |2J]- ^^ the security 
of a QSS protocol is based on the error rate analysis of 
the samples chosen by the parties of the communication, 
the dishonest agent can obtain all the information about 
other agents' if his eavesdropping does not introduce the 
errors in the samples. In fact, almost all the QSS proto- 
cols [Illlilllllllllllllllllillliiillla based on 
the collective eavesdropping check can be eavesdropped 
fully and freely with a cheat if he has the capability of 
performing entanglement swapping |32| and storing the 



quantum states. 

In this paper, we will introduce a fake-signal-and- 
cheatin g at tack on the QSS protocols [Ui. Il2 . Ull IM 
IlllIlllllIllIlESillia based on the collective 
eavesdropping check. It will be shown that the dishonest 
agent can steal all the information of the other agents' 
freely and fully with entanglement swapping and cheat- 
ing. Moreover, we present a possible improvement of 
those QSS protocols' security with some decoy photons. 
We hmit our discuss in the two famous QSS protocols, 
HBB99 [m and KKI [l3|. For the other protocols, the 
principle is same as them with or without a little modi- 
fication. 

Same as that in IIBB99 QSS protocol [13, the 
Greenberger-Horne-Zeilinger (GHZ) triplet that Alice 
prepares is in the state 
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where |0) and |1) arc the two eigenvectors of the operator 
z (for example, the spin of a photon along the z direc- 
tion), and I ± x) and | ± y) are those for the operators x 
and y, i.e.. 



+ x) ^ _(|0)-H|1)), \+y) 
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71 



(|0)+*|1)), 



I - ^> = ^(|0) - |i)), \-y) = ^(|0) - *|1)).(2) 

The principle of the HBB99 QSS protocol llj in the 
simple case can be described as follows. 

The boss Alice prepares a GHZ triplet in the state 
I*) ABC = "71 (1 000) + \lll)) ABC and sends the photons 
B and C to her two agents. Bob and Charlie, respectively, 
and keeps the photon A. All the three parties choose 
randomly the measuring basis (MB) a; or ?; to measure 
their photons. They repeat their quantum communica- 
tion until they obtain an enough large set of outcomes for 
generating the private key Ka = Kb ® Kc- Here Ka, 
Kb and Kc are the keys obtained by Alice, Bob and 
Charlie, respectively. Then they publish the information 
about their MBs. When they all choose the MB x or 
two choose the MB y and the other one chooses the MB 
X, they retain the corresponding outcomes for generat- 
ing their private key, otherwise they discard them. From 
the Eq.J^I, one can see that their outcomes retained are 
correlated. In other words, any two parties can deduce 
the outcome of the other if they cooperate. For checking 
eavesdropping, Alice chooses randomly a large subset of 
the outcomes obtained by the three parties to analyze 
its error rate. That is, Alice requires Bob and Charlie 



announce their outcomes on the samples in public. If the 
error rate is lower than the threshold value, they keep 
the outcomes for distilling the private key Ka- 

As pointed out in Ref. 12], if QSS protocol is secure 
for the dishonest agent, it is secure for any eavesdropper. 
In essence, Alice requires the dishonest agent, say Bob 
publish his outcomes of the samples in the process for 
checking eavesdropping in HBB99 QSS protocol. Just 
his process makes Bob have the chance for hiding his 
eavesdropping with cheating. Now let us introduce the 
fake-signal-and-cheating attack on HBB99 protocol. It 
includes two steps. 

(1) Bob replaces the original photon C with a fake 
photon C". That is. Bob intercepts the photon C which is 
sent from Alice to Charlie, and stores it. He sends a fake 
photon C" in the Bell state \(I)+)b'C' = -7|(|0)s'|0)c' + 
|1)b'|1)c") to Charlie and keeps the photon B' . The 
process is repeated until the parties stop the process for 
transmitting the photons. Bob does not measure the 
photons B, C and B' until Alice and Charlie publishes 
the MBs for their photons. 

(2) Bob cheats the other parties when a GHZ triplet is 
chosen by Alice as a sample for checking eavesdropping. 
In detail. Bob first performs a Bell-state measurement 
on the photons B' and C, and then hides the difference 
between the state of the quantum system composed of 
the photons A, B and C" and the original state \'$) by 
publishing a fake information with a cheat. 
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That is. Bob can deduce the difference between the state 
of the system \^)abc' and the original state \^)abc ac- 
cording to his outcomes with the Bell-state measurement 
on photons B' and C. He can hide the difference by 
publishing a fake information with a cheat. 
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= ^[i\ + y)\ + y) + \-y)\- y))AB \ + x)c' 
+{\ + y)\-y) + \-y)\^y))AB\-x)c'l (6) 

|*)2 ^ -i=(|001) + |110))^BC' 

= i^[{\+^)\+^) + \~^)\-^))ab\+x)c' 
-{\+x)\-x) + \-x)\+ x))ab\ - X))c'] 

= \[{\+y)\~y) + \-y)\+y))AB\+x)c' 
-{\ + y)\ + y) + \-y)\-y))AB\^x)c'], (7) 

= ^[{\+^)\-x) + \-x)\+x))ab\+x)c' 
-{\+x)\+x) + \+x)\+x))ab\- x))c'] 

= 2 [(I + y> I + y> + 1 - ?y> I - y))AB \ + x)c' 
-{\ + y)\-y) + \-y)\^y))AB\-x)c']. (8) 

From Eqs.lQJ, lO and Eqs.Q-llHll, ^^^ can see that 
Bob can hide his eavesdropping by flipping his outcomes 
when he obtains the outcomes of the Bell-state measure- 
ments \(t>~) and |-0~) whether he chooses the MB x or y. 
As Alice and Charlie cannot detect this eavesdropping, 
Bob can measure the other photons transmitted from Al- 
ice to Charlie after all the parties published their MBs 
for their photons. In this way, Bob can obtain all the in- 
formation about Charlie's outcomes with single-photon 
measurements, i.e., Kc- With his key Kb^ Bob can read 



out the secret message sent by Alice without cooperating 
with Charlie as he obtains the key Ka fully and freely. 

With this fake-signal-and-cheating attack strategy, the 
dishonest agent can eavesdrop freely and fully the in- 
formation of the other agent in KKI QSS protocol 
|1^. The important difference between HBB99 pro- 
tocol [ij and KKI protocol [l2| is that the quan- 
tum signal prepared by the boss Alice is a two- 
qubit maximally entangled state, one of the four 
states {\i>+)BC, \(t)~)BC. |*+)bc, \^')bc}- Here |*+) = 
^(ir ) + 1^+)) and 1$-) = ^(ir ) - 1^+)). The pho- 
tons B and C are the particles sent from Alice to Bob 
and Charlie, respectively. In the quantum communica- 
tion. Bob and Charlie choose randomly the MBs x and 
z to measure their photons received. After an enough 
set of outcomes is produced, the three parties compare 
their MBs and keeps those in which their MBs are corre- 
lated. They check the eavesdropping by picking up some 
samples from their outcomes. 



Same as the case that the dishonest agent eavesdrops 
the quantum communication in IIBB99 QSS protocol, 
Bob also prepares a fake entangled state \4>'^)b'C' and 
replaces the original photon C sent from Alice to Bob 
with the photon C". Bob stores the photons B and C. 
He measures them after the parties publish their MBs 
for their photons. Suppose that the original state of the 
sample chosen by the three parties is |^')_bc — a|00)BC + 
/3|01)BC + 7|10)i3C + ^|ll)i3C (|a|2 + |/3|2 + |7|2 + |5|2 ^ 1). 
Bob can hide his action with entanglement swapping and 
some a local unitary operation on his photon B as 



J 



W)bc ® |0+>B'C' = (a|00)Bc + /?|01)i3c + 7|10)sc + 5\11)bc) ® ;/|(|00) + \^^))b-c- 



-[(a|00>+/?|01>+7|10>+(5|ll>BC')l</' 
+ (a|01)-H/3|00)+7|ll> 



CB' + («|00) - /3|01) -I- 7|10> - 5\ll)BC')\<t>ncB' 
5mBC')i^+)cB' + (a|01> - /5|00> + 7|11> - (5|10>bc')I^">cb'] 
I 



That is. Bob can easily reconstruct the original entan- 
gled state \^')bc prepared by Ahce when it is chosen 
for checking eavesdropping. He need only perform the 
local unitary operation [/q, C/i, C/2 or U^ on his photon 
B according to the result of the Bell-state measurement 
on the photons C and B' is |^~), |'0~), \4'~) or |0^), 
respectively. Here 



C/o = |0)(0| + |l)(l|, C/i = |0)(l|-|l)(0| 
C/2 = |1>(0| + |0)(1|, [/3 = |0) (0| - |1) (1| 



(9) 



In fact^ almost all the QSS protocols [Tll lTllTU ll 
El m. El III 111 EO, 21, 22], in which the eavesdropping 
check is complete with the cooperation of the dishonest 
one whether the protocol is based on one-way direction 



quantum communication or two-way one, can be eaves- 
dropped freely and fully. The principle is same as those 
for eavesdropping the HBB99 |ll| and the KKI [l3 QSS 
protocols with or without a little modification. 

For improving the security of this kind of QSS proto- 
cols ilL 12, II, ii , J^, i£, 11, 18., la, 2Q., 11, 22] , Alice 
should provide a process for checking eavesdropping with- 
out the cooperation of the dishonest agent. In a simple 
case, Alice can insert some decoy photons in the quantum 
signal sent to each agent. As the process for analyzing 
their error rate needs not the other participants except 
for the one who received the decoy photons, the action 
of the eavesdropping done by the dishonest one will be 
detected. Let us use the HBB99 QSS protocol as an ex- 



ample for describe the principle of the way for improving 
its security. In detail, Alice prepares some decoy photons 
which are randomly in the states {|+a;), |— a;), |+y), \—y)} 
and then replaces the photons B and C in the GHZ triplet 
\'^)abc with the decoy photons some a probability 1—p, 
similar to the QKD protocol in Ref . [3| • After the parties 
announce their MBs for their measurements on their pho- 
tons, Alice picks up the outcomes of the decoy photons 
as the samples for checking eavesdropping. Even though 
half of the decoy photons will be discarded as the MBs 
chosen by the agents and Alice is not correlated, same as 
BB84 QKD protocol 0\, the process for checking eaves- 
dropping requires only one of the agents cooperate with 
Alice to analyze the error rate of each subset of the decoy 
photons, which does not give the chance to the dishonest 
agent for eavesdropping the information of another agent 
freely. 

The decoy photons can be prepared with another ideal 
single-photon source. Also they can be prepared by mea- 
suring some of the photons in the GHZ triplet 1 4') . That 



is, Alice can performs the single-photon measurements on 
the photons B and C with the MB x or y, and the pho- 
ton A can be prepared to a state needed by Alice. The 
advantage of the way for preparing the decoy photons is 
that Alice need not resort to another ideal single-photon 
source. The disadvantage is that Alice maybe waste some 
of the GHZ triplets. 

In summary, we have present a fake-signal-and- 
cheating attack for the dishonest agent to eavesdrop al- 
most all the QSS protocols [ll|ll|ll|ll|ll|ll|ll|ll 
[l3,|20,|2j|23 in which the process of checking eavesdrop- 
ping has to resort to his cooperation. With this attack, 
the dishonest one can obtain the information of another 
agent freely and fully. Moreover, we discuss a possible 
way for improving the security of this kind of QSS pro- 
tocols. 
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